Security and Access

Access¶

PVGIS Web API is publicly accessible and does not require authentication for standard usage.

This means any client can call the API endpoints directly. Consumers should still follow usage limits and good client behavior (retry with backoff, cache responses when possible, and avoid burst traffic).

Rate limiters¶

Rate limiting is enabled to protect service availability and ensure fair usage across clients. Requests are constrained using several complementary windows:

Scope	Limit	Description
Global (application-wide)	10,000/day	Overall daily cap at application level.
Per client (hourly)	200/hour	Rolling hourly limit per client.
Per client (per minute)	100/minute	Short-window control for regular bursts.
Per client (per second)	10/second	Strict per-second protection against spikes.

When a client exceeds a configured limit, requests are temporarily rejected until the corresponding time window resets.

CORS policy¶

A strict CORS policy is applied.

Only explicitly allowed origins, methods, and headers can access the API from browsers. This helps reduce cross-origin abuse while keeping intended integrations supported.

Error Handling¶

Bellow you will find an analytical table with possible errors that can be returned in an web API call.

Code	Explanation	Description
`200`	Success	The request was successful.
`400`	Bad Request	The endpoint rejected the request due to incorrect inputs.
`404`	Not Available	The service is not available.
`429`	Too Many Requests	Too many requests.
`450`	Data Unreachable	The data are unreachable.
`460`	Service Unreachable	The web API services are unreachable.
`500`	Server Error	Something went wrong on our end; if it persists, send a help ticket¹.
`502`	Bad Gateway	Something went wrong; if it persists, send a help ticket¹.
`504`	Gateway Timeout	Something went wrong; if it persists, send a help ticket¹.
`550`	Data Issue	An error occurred reading the data; if it persists, send a help ticket¹.

Use the web API template for the issue generation. ↩↩↩↩